Archive

How Define a variable to use it in other search?

New Member

Hi experts, im trying to definde a variable in my search to use is in other search. it should work as a filter in the other search.

"companyNames" is a sourcetype where several company names,Keys are stored for example Key 100001 is customer1.

on the other hand i have the sourcetype "groups" which contains groups for all the companies.

what im trying to do is to filter my second seach by searching the key 100001 so i can define a variable which will be the index for the other search, the indexes for groups are "key-cc" so this is why i define the variable id1 as "Key-cc" but the second search is empty.

sourcetype=companyNames Key=100001
| eval id1= Key."-cc"
| search sourcetype=groups index=id1
| table groupId,groupName

if i search like this:

sourcetype=groups index=100001-cc
| table groupId,groupName

the search have values. please your help telling me what im doing wrong.

thanks in advance.

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

@evelandi,

search takes the terms given as literal and hence even though you assign some value to the variables. In the above example, your final search will still be index=id1 and not the value. You may verify that from job inspector.

To make the above search work, you can use where which work as conditional expressions

 sourcetype=companyNames Key=100001
 | eval id1= Key."-cc"
 | where sourcetype=groups AND index=id1
 | table groupId,groupName

However, looking at your original requirement, you may try

sourcetype=groups [ sourcetype=companyNames  |"search for all keys"|eval id1= Key."-cc"|rename id1 as index ] 

Final search will be formulated as sourcetype=groups (index=100001 OR index=100002)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!